I'm trying to create the self-signed server certificate for the Postfix user:
thufir@dur:~$
thufir@dur:~$ sudo ./tls.script
Error opening Private Key
3073578684:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('','r')
3073578684:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
unable to load Private Key
thufir@dur:~$
thufir@dur:~$ nl tls.script 1 # dir="$(postconf -h config_directory)" 2 # fqdn=$(postconf -h myhostname) 3 # case $fqdn in /*) fqdn=$(cat "$fqdn");; esac 4 # ymd=$(date +%Y-%m-%d) 5 # key="${dir}/key-${ymd}.pem"; rm -f "${key}" 6 # cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}" 7 # (umask 077; openssl genrsa -out "${key}" 2048) && 8 openssl req -new -key "${key}" \ 9 -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" && 10 postconf -e \ 11 "smtpd_tls_cert_file = ${cert}" \ 12 "smtpd_tls_key_file = ${key}"
thufir@dur:~$ as per the Postfix quick-start on TLS.
thufir@dur:~$ postconf -n
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
default_transport = error
home_mailbox = Maildir/
inet_interfaces = all
mailbox_command =
mailbox_size_limit = 0
mailman_destination_recipient_limit = 1
mydestination = dur.bounceme.net, localhost.bounceme.net, localhost
myhostname = dur.bounceme.net
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
myorigin = /etc/mailname
readme_directory = no
recipient_delimiter = +
relay_domains = lists.dur.bounceme.net
relay_transport = error
relayhost =
smtp_tls_note_starttls_offer = yes
smtp_tls_security_level = may
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_local_domain =
smtpd_sasl_path = private/dovecot-auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/ssl/certs/smtpd.crt
smtpd_tls_key_file = /etc/ssl/private/smtpd.key
smtpd_tls_loglevel = 2
smtpd_tls_mandatory_ciphers = medium
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
transport_maps = hash:/etc/postfix/transport
thufir@dur:~$ Do I need to run the script from a certain location? I was just running it from my home directory, with sudo.
Incidentally, I would be ok with using the snake oil certificate.
11 Answer
Fixed the issue using the helpful reply of muru in a comment.
Uh, those
#signs in the Howto are supposed to represent the prompt. They're not meant to be part of a script. Each # represents the beginning of a new command.
thufir@dur:~$
thufir@dur:~$ sudo ./tls.script
[sudo] password for thufir:
Generating RSA private key, 2048 bit long modulus
....................................................................+++
.........................................+++
e is 65537 (0x10001)The content of tls.script should be like this (without the leading # marks as in the question)
dir="$(postconf -h config_directory)" fqdn=$(postconf -h myhostname) case $fqdn in /*) fqdn=$(cat "$fqdn");; esac ymd=$(date +%Y-%m-%d) key="${dir}/key-${ymd}.pem"; rm -f "${key}" cert="${dir}/cert-${ymd}.pem"; rm -f "${cert}" (umask 077; openssl genrsa -out "${key}" 2048) && openssl req -new -key "${key}" \ -x509 -subj "/CN=${fqdn}" -days 3650 -out "${cert}" && postconf -e \ "smtpd_tls_cert_file = ${cert}" \ "smtpd_tls_key_file = ${key}"
